← Back to context

Comment by lima

13 days ago

If Kernel Lockdown is enabled, a zero-day exploit is required to bypass module restrictions without a reboot.

Unfortunately, threat actors tend to have a stash of them and the initial entry vector often involves one (container or browser sandbox escape), and once you have that, you are in ring 0 already and one flipped bit away from loading the module.

The Linux kernel is not really an effective privilege boundary.

4 comments

lima

Reply
Imustaskforhelp  18 hours ago

So what would you recommend instead? To run workflows in VMs?

  • Joel_Mckay  18 hours ago

    A kvm hypervisor is not perfect, as sandbox escape was demonstrated even with https://qubes-os.org/ . On modern AMD/Intel/ARM64 consumer processors it is not possible to completely prevent bleeding keys across regions.

    Only the old Sun systems with hardware encrypted mmu pages could actually enforce context isolation.

    If performance is not important, and people are dealing with something particularly nasty... than running an emulator on another architecture is a better solution. For example, MacOS M4 with a read-only windows amd64 backing-image guest OS is a common configuration.

    https://github.com/86Box/86Box/releases

    https://github.com/Moonif/MacBox/releases

    Best of luck =3